The Problem with Identity Proofing


As part of settling IIW Europe, I needed to send a wire transfer for $5000 to a company in London. I logged onto my account at my bank and set it all up. This process involved not only logging in with my secure password, but also having a "security code" sent to my phone four times along the way that I needed to type into the Web page to prove I was in possession of my phone--or something: once for setting up the wire account, once for setting up the recipient, once for sending the wire, and once for something else.

Today I got an email from the London company saying the wire didn't arrive, so I went to the bank's Website again only to be told that my username and password were "frozen" and I needed to call an 800 number to fix it. I called the number and they started an identity prooofing process to make sure they were talking to the owner of the account. They asked:

  • My business name
  • The EIN
  • The business address
  • My name
  • Last six of my SSN
  • My address
  • My phone number

Apparently, I got some part of that wrong or it didn't match the profile information I have on file, because the guy on the phone didn't seem happy, so he launched into a "things you should know if you are you" identity proofing process. These services are available from Equifax and Acxiom and maybe others. He asked:

  • Which of the following addresses have you lived at before? I said "none" because I hadn't.
  • Which of the following vehicles have you owned? I answered that one right, I think.
  • Which of the following towns does Tracey Windley own property in? One of the options was "I don't know Tracy Windley" and I picked that.
  • Another question about Tracy Windley. I again said I didn't know Tracy Windley.
  • Which of the following towns does Jill Windley own property in? I saud I don't know Jill Windley.

Well, I failed this one as well apparently because he told me I had to go into a branch and prove to the branch banker that I was really Phil Windley. Apparently, I found out, the wire I sent was rejected, for no knowable reason and that was why my account was frozen. I wasn't notified the wire was rejected and neither the person at the bank or on the phone can give me a reason why it was rejected. Now, I've got the account unfrozen and the wire reissued. But the interesting thing is why the identity proofing failed.

When I said I don't know Tracy and Jill Windley, I was lying because I do know them. They're my cousin's kids. What I couldn't figure out is why I was getting asked where my cousin's kids owned property. But I think I know now. When I moved from Moscow Idaho in 1993, my cousin Paul, who was the Dean of Art and Architecture at the University of Idaho where I was a computer science prof, bought our house. There have been Windleys living at that address for 20 years. But two different families. Apparently that last fact is lost to Acxiom, Equifax, or whoever. They think Tracy and Jill are my kids. And access to my bank account depends on that.

Where does it end? Clearly what banks are doing now to prove identity online is not convenient and doesn't scale. I don't understand why they think solutions like information cards won't be accepted by consumers when they're putting people through what they are. At least Paypal gives me the option of buying a key fob that does one-time passwords. Give me that option at least! Something has to change.